wallabag vulnerabilities
11 published CVEs name wallabag among the affected products.
- 11Published CVEs11 of them scored
- 3Last 12 monthspublished in the last year
- 0Critical2 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-110228
wallabag 2.6.13 through 2.6.14 Stored XSS via Failed HTML Import Upload
wallabag · wallabag
Medium5.1 - CVE-2026-82089
The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView.
wallabag · android-app
High8.8 - CVE-2026-82081
wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export.
wallabag · wallabag
Medium6.4 - CVE-2023-0737
CSRF in wallabag/wallabag
wallabag · wallabag/wallabag
Medium6.5 - CVE-2023-4455
Cross-Site Request Forgery (CSRF) in wallabag/wallabag
wallabag · wallabag/wallabag
Medium6.5 - CVE-2023-4454
Cross-Site Request Forgery (CSRF) in wallabag/wallabag
wallabag · wallabag/wallabag
Medium4.3 - CVE-2023-0734
Improper Authorization in wallabag/wallabag
wallabag · wallabag/wallabag
High7.3 - CVE-2023-0736
Cross-site Scripting (XSS) - Stored in wallabag/wallabag
wallabag · wallabag/wallabag
Medium4.6 - CVE-2023-0735
Cross-Site Request Forgery (CSRF) in wallabag/wallabag
wallabag · wallabag/wallabag
Medium6.5 - CVE-2023-0610
Improper Authorization in wallabag/wallabag
wallabag · wallabag/wallabag
Medium5.4